Related blog content
Spyware.FFDroider is after your social media cookies and credentials
Spyware.FFDroider is Malwarebytes detection name for an information stealer that targets social media credentials on Windows machines.
Spyware.FFDroider searches the affected system’s browsers for login credentials and valid session cookies to run malicious advertisements from the victim’s account and utilize the compromised accounts payment method to spread the malware further. Spyware.FFDroider is offered on download sites pretending to be installers for freeware and cracked versions of paid software.
Malwarebytes can detect and remove Spyware.FFDroider without further user interaction.
The malware creates a directory in %UserProfile%\Documents named VlcpVideov1.01
In this folder it drops the file:
Install.exe
The malware is hosted online as:
vinmall880.exe
vinmall1.exe
lilay.exe
SHA256 hashes:
3596982adf10806e7128f8f64621ec7546f4c56e445010523a1a5a584254f786
7eb7bd960e43164184e41cdacf847394a5aa8b7bce357d65683bc641eef3381b
94031fe0fbda71abdfa4f51c370d0da17deae7578549a81335dfbb446f75c474
d7e81d5c26a9ff81d44ff842694b1a8732211e21ac32a471641c4277c1927ca5
Subdomain:
download.studymathlive.com
Update server: http://186.2.171.17/seemorebtu/poe.php?e=<filename>
Select your language